An operating system of a computer system typically generates a “core file” when the operating system recognizes a system crash or internal failure. These files are also called “core dumps” or “crash dumps,” and are used for fault analysis and to debug a program or operating system that encountered a problem. A core dump generally represents the complete, unstructured state of the program or operating system memory at the time of a crash.
Core files can prove to be effective debugging aids in several situations. Core files allow a user to save a crash for later analysis or comparison with other crashes. A core file can be several Gigabytes in size depending on the memory size of the crashing device or program memory size. The size of these full core files can make it cumbersome to isolate the crash triggering fault that caused the internal failure. The size also makes it cumbersome to transmit the file over communication links. Furthermore, because the memory of a device or the program that encountered a problem can be very large in size, it can take a very long time to create the core dump. As the core dump is being written, any changes to the memory of the device will result in an inconsistent picture of the memory that is nearly impossible to interpret. Therefore, core files are typically only written out when the memory can be safely locked down for a period of time, thus causing downtime of the computer system.
Further, there are many cases in which a problem with the operating system is not serious enough to require a reboot. However, because a core dump may be useful or needed to debug the problem, a crash must typically be caused to allow the core file to be created. This causes unnecessary downtime and leads to inefficiency.